Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 22:47
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x40c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
42KB
MD56a386dcc3824fee4958cd5d28f30cfec
SHA12e3968ee6ded913f0c953ca158c657dea2db2dfa
SHA256ee71570880db7f920f023c800c564ea6e2f94788f8bb08e5f5ec6eb3a64f0374
SHA5123c7cdd4f3c4f17706b420033a98042f9d2c4f7a70b65cc5910b0a6602748ed471404c035300ab247a0bd7fcdf766c2cd1e626649ef8c0ccabb049d68d99c7a6a
-
Filesize
9KB
MD580cb5d060ba9d06c683ff7f7f85bcabc
SHA13a3ba7ff8ce959463e89296e85216cd568146d54
SHA256ff0a5e866b84953cdced0e49e3e02063d5a22c04c2227e2602accc5d841278a7
SHA5121f68caaab5ff211a6e30b5fa16449a3dd1aad4c5e88e7389e8fde90c70031550fd66647cae0153e82b8caa9e58edc69d0a7c1e67f0b9a06ad9436ba8027b1455
-
Filesize
2KB
MD53f765ccf37e3d533e67c1dbd91d620f3
SHA11522f22dc9a01a80dbeecc6a1b63bfbac0369e2e
SHA256ee5cdaff9fa056b84cadb7b2a1f73841165fcd265eb8842781688761f3959913
SHA51295ee8dfa41e1acdc620ab176bb2154abbbc1ac94444d6327b31515d4211bd80f21a76a0d454f76992f043033329d3e29a81906f5e949f1b0b0c3cc6416e42c5d
-
Filesize
2KB
MD5524263730039c2a2f83c3af9ee5de192
SHA1c2a912f4f0e21d1d9f9e0805f4e12035d975b23e
SHA256a5cc669e2c5a30393011e04dad168ec2d3224324ee0ab4fcdff810034dab459e
SHA512c2b9177401119f83d8680c7f1c576bb65ec64225c18b92f789daadadbde8b47a06d958b6d1c4e1635bb0bebf0298c53de10fe066236102894f2c42c9b2516f72
-
Filesize
681B
MD55cacc27347f2c8f75aa63a92050de36b
SHA1711c53aba72cf4a0d27e077df589d165b85f75af
SHA2568e5d0930b7ff5043a9b01bc32006543344efef58981bb7f275fad8072f97f4e9
SHA512c503a493130624264a8021222c89deb5e36657dd52ce23de82da88a7e8829f2e0a979148436e53ca9fa559226697008f43d76075f81ca16c593151b9d4fd0414
-
Filesize
802B
MD5e0ca0dbdf87d486c13d8f37f4adbf6cf
SHA142434e530f43ce474e81938b7b95dffe6a331266
SHA256f1d1cf915b3e674da8b12dacf861f3aeb6a0fdc141ea7599832951dc439510e6
SHA5120dc943a96ba40c1dba269180125f0859e72166bc3b26358661d0793650852a17de4ccc295834431f2efc6b8ed4f76bf5db76ccd7056600de19cade2dfb435dd7
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD533c31d889badb37a0035ef0fcfa6644f
SHA198404e6dcdeb6f46a2fda6d1cf6970a5af9d8382
SHA2568940058f747c97dade3428f61edb45d2aac91a55bdb5b9ac8fb2cab22ca980da
SHA512cce23c3aca3f36bdb92903ed2bc9335624e1af867ee199de5f241d932d3ab861542aacce38409943f39aee2569bfa66ac707e7bb49dd4747ca813a44c4da8b68
-
Filesize
3KB
MD57897a550477eff8dd6d6d42fb7c2b0c5
SHA1654e53fd1c8520f988f2da21588be70d6e1b2ca2
SHA25645513045091c241d3c226d3cb240a4c8b44ec88a8598d80fc51fe693144150cf
SHA51268d74eb511cf54620a8683bf54b8a364cbef88a2f3d14e626f7d10262afa4d110d1f3090aae1a9adebc7190b51a47afc79909797193d4cbeddbd9d42d526371e
-
Filesize
3KB
MD58fdfc3cf333fce5ee3017ffba49905e4
SHA1c3eb00b5de2f15310c9758457e69f7899e90b677
SHA2566485a8a34a318c8e0c7c246a6b21bd225a98c668b8e8f42f6f8fd014317594b2
SHA512417a9f0b4e13354bde9324ff80a3aacb54bff46c81bed31d4e3d65a91abdca83298087648f0a5c00138d7b0cb25f4f20c340ac3c4d5c0a73e7ebf8c89de1c972
-
Filesize
1KB
MD5eddd5bf69b8da73117cf2728b3e13c49
SHA1ff7fb15b0a10be8986c537ac8fd55af27cdabbac
SHA256ce48e68864c31a59a028df44e5bdf2a07d85335ba3b05a47ecda230d004773ab
SHA51245e0c448a045f6156015a4396b4bba19596a2cfaff67eb8b290f26f933cc1bbe9e832fdd22ffe2f15be7037b96578feeb294a6737997d51f7153ff19ecee7673
-
Filesize
6KB
MD56d9b3b73421512d1ac5caa4a4bd73c4d
SHA184b59b3192a26c25b927e4a6efb0fb88504de167
SHA256c19259c45a820eaca126dbfebc967f08c01932d37ea8a79d8d1d4c4dde0c5ede
SHA51203c03cbb30d5a6698af2fdc06d1fe59dd840976d1ac6e8d4d744cb3423072613b2bef60d8f733ebb75931d0fb286efde9a3ba08af05dafb7150f565c9ef7194c
-
Filesize
6KB
MD5b39517ecc540185d01f8ac50f03b0360
SHA1c997788fe69bd25e10e3a97cb12af9669916fca1
SHA256fe0eed9c12c843b9ecdae0dea76042f3d2dbcaf17dfc25be877bfbbd765896c9
SHA512cb7b168b8712363d2797be603ca7706fa93daae5315afa9837b28ca487dd8f643a97d8c4b8049074d095ac0521acc620ce1be2d88c765784f8ee68d83a1b5b26
-
Filesize
1KB
MD5b4e35367de2f2ddec268ae613fd0c8b6
SHA18188af4946f094e77179dcb5041718d3e54a2928
SHA256ddac0280a75e417880fae2c96ee7eced8f476412b09c5ca6acad459e1fd63621
SHA51249bf93cfaa654de9c564146a9675ac003c9098f6b036f575ce323c3073dcbdff02c1319d1c4a27bbaa5e14afdb5db64ba76cb8a6f5eaf634adb4cf3ceddb9980
-
Filesize
7KB
MD57b754bffc7b071e0a2c8356c21075350
SHA15b57d29cb3381bd55b6301fc3ff8f4b9d70c3872
SHA2567a8aa9dbb4005dcfc7b20120cd73146bc75423f56a50358ee91a3c1b5fd6fdc5
SHA512b2a79afc8eb1fd300979074b278f88a3f521f37d10acd2f40904792bd2a7458f3d66e6a996b09d289af7b04c8d512ffaa2fe94f2817f8dfaaacabfba512bcff8
-
Filesize
7KB
MD54926dc30803d46cd315cc2780f32e7c6
SHA1dd33c39aff89e17f15af20f6bf0a650af8ef4cb6
SHA256ba328691d7d27a35da8eb9f7bbc1aef658b62ecd2a8332eff96f142505cfeb10
SHA5120e23a9ccdd83bcbd2ae53a3d32a5cfc7707dfadd9a86f84b33fa6c5a2669d3f5b0a26f2ba2921645c5b4add7d5db4f9a94aa34da87618cf33cbf6d7afadf15ea
-
Filesize
7KB
MD546e68210e837d82e562168f2a07f5e6b
SHA1fba68b3ee6ac7a22efbf97cec5c8e2f7d2ddae53
SHA2561a3c9d8c9e1dc73540698b3392e1fd1f8bebffd94da03b11274035294701184b
SHA5129b32f712426a8cf302cbdaa47e4ead616f2310333bdbe3933a4f6edc7907d194734cdeadf644ba1c74e2eceace0bbaedfc7b95e4006f70db90313c0cf0496f68
-
Filesize
7KB
MD5d4c39c1f0bf9555e491845ff62c678b7
SHA194dfa36c39c554e756d46716e94bbef7db351b47
SHA256565389da60a5faa3aeeb2afe7bf8a8e746d970b891f551a505d7a974c018424b
SHA51298b140a2a847543b4848a44faf50d1ec9e0cfa3941e199d2d179d9e5c4da651aea06233f354c4a306837806a5fdb33a329ed873af42e9a562df637172d9b034d
-
Filesize
7KB
MD55b165fa5847344f7e61816a15cf3df8f
SHA1ab7ef51ea02b9e2419460ab5b90320b6d9a490aa
SHA2564dfede827ef8627f3971e4baf3bafcf15130fce7d0b8804bf7ce03c066404b33
SHA512a3b8a30a1e41ae00c259995bceb81bbe6b3dae386e0a7337f15dfedc982f9827e286a47684f5f45b2fc63c48f23f7e3bc4cd519d43c80b80d992a5b1e091c2cc
-
Filesize
7KB
MD5f3757dd1cdd9e978576b1eef916cc7d4
SHA1321296073092fa1a29133694baa7dced4599daad
SHA25670f43ef594a7b54840b12158293fb560d7b152502ff3320fb3a48eb72804b0eb
SHA5121b39bf7b9dcbdf251e47bc9b5f48a5576e1cb6376e9da8811946bfce27d2e1f19fe7186e6c904b9b4de4aab842d74a4e8c858a1a1c2b02092255988b2e036625
-
Filesize
7KB
MD5b708ba1a441a09b993669ab72c377f4f
SHA10315e90d54c9632b65ac3e633595b55b41eefee5
SHA25661ce25b2c57644f11a888b69a238a03f4e443e72f5dc71c3c256d61c7ea386a7
SHA5127ab725ebb3ddec585d2f94832f5c10d925cdc86b10fcbe99e2136e2c3ab7dd3130009b72d7b2cf025aa554d0fd71c74b2d1ff0da13ca5522edd60e590823ed36
-
Filesize
7KB
MD5c29112745c8b01c7df73a7ceb33d05bc
SHA1f43cfe3571d59cd1f0620a65a0969a6deece2a9f
SHA2562a58592c1b669551f7e7ec6490cab391cc32510dce3656b577c37921e3660728
SHA5124c39ec2612c2ca30bfa70cb5b20d031338fa03ad26c61d6028909370f9a8d72be0a8118b748f3b233e108fdd55ead8edb32c671f2802a4425bc03e98c150f4bc
-
Filesize
7KB
MD5a6be789d8ebcbd65b37f572246e6583c
SHA139a1381b4a8fc30154a651ea5a5423e286cfa52b
SHA256f5131c40c11ff5939669994ad4ba9a100f134afe2db7693d789b00c7f5f4ce39
SHA512e2f70b9064220f59e9e3e9c6a57347258a8eec52a53bfcb8b7da0cf86aaacd588ca243059f7f5c98fedd7b4d8fd52be8ae75d078cb6514024eb786661cac0aff
-
Filesize
1KB
MD5e4e049f9a157b3543664878f0c2b05c9
SHA11990b4abc23bbd34a863b46cc5e42fdd88b7ee55
SHA256ab3c55a88e3032a984159090e97979638bc0856193f2b544f18d9d3e7de0d8d9
SHA5122b14b187bfda5ac57ad42261dd669d4c99ef697e50fde02e98bac63a4266c75efdac1042a9989411263a49fde63790f37638442a077d9385d06eb46967326aae
-
Filesize
1KB
MD531c7e2ecca9e87d48b4b38eada8dc7d0
SHA14086815b2e68760bd746fd12a0a7c39911f00159
SHA25605e66a2390386e14038d8dd73854df7cc598920ba8fabdfd1e4f22bd826bd851
SHA512576bdb362d40c097bd76702d1d82d564383831b2d8fda488703d3f523e0639660e70919897b7a79f2969e82d370b9a33ec2d0befc416ebd157e28b40dda181b7
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB